Anonym.OSBecause no one needs to know

kaos.theory security research presents:

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Who We Arekaos.theory: loose-knit group of security professionals, hackers, artists and general lunatics

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Show and TellAnonym.OS is:

An OpenBSD 3.8 live CD

A secure environment, usable by anyone, that provides a full suite of applications configured to run anonymously and over encrypted channels

Easy enough for your mum...assuming she has something to hide

k a o s . t h e o r y s e c u r i t y r e s e a r c h

What It Isn’tAn auditor / pen-testing / haxx0ring toolkit

Anonym.OS does not have:

Port scanners

Vulnerability scanners

Exploit collections

Password crackers

Forensic tools

Office suite

Why?

k a o s . t h e o r y s e c u r i t y r e s e a r c h

The Environment TodayHostile: adware, malware, spyware

Insecure: apps, OSs, networks, protocols

Heightened monitoring by governments and corporate interests

k a o s . t h e o r y s e c u r i t y r e s e a r c h

but...also the place where alot of people:

communicate

create

buy and sell

share

work and play

speaking of work.....

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Annoying ProxiesWhile trying to research for this presentation...

k a o s . t h e o r y s e c u r i t y r e s e a r c h

More NetworksThe proliferation of very convenient but dubiously secured networks

k a o s . t h e o r y s e c u r i t y r e s e a r c h

You don’t have to wear a tinfoil hat any more to be worried about privacy

activists, organizers and dissenters

“Persons of Interest” under scrutiny from fascist regimes

Wage slaves (and executives) on corporate networks

people who buy stuff

your mom

her mom

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Investigation ToolPrivacy is as useful to a federal agent as it is to an average citizen who wants to protect their own privacy

Provides the ability to investigate child porn, identity theft, terrorism without raising alarms or scattering originating IPs in the bad guys logs

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Good! ....except...Maintaining anonymity is becoming a difficult thing to do

Many tools exist to assist the savvy user in remaining anonymous...

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Configuration Overload!But what about a normal user faced with multiple manual configurations?

How?

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Design GoalsMust be an inherently-secure system

Must be able to bypass restrictive filters without user interaction

Must be as “quiet” as possible on a network; no “chatty” protocols like SMB or NTP

Must help ensure confidentiality and integrity without additional configuration

Must be easy to use!

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Tools Available:Anonymizing networks:

TorJAPI2PMorphmix / TarzanFreenetEntropy

Local web proxiesPrivoxyJunkbusterRabbITWebCleaner

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Building the Anonym.OSStart with a minimal base OS

Harden the host

Institute strong ingress and egress filtering

Perform onion routing

Utilize anonymizing proxies

Use encrypted protocols wherever possible

Provide GUI and CLI applications to accomplish typical tasks

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Securing the HostWhich operating system? OpenBSD!

Secure by default

Hasn’t been done before (at least not well)

Using OpenBSD makes you k-rad 1337

Modified TCP behaviors to fool passive OS fingerprinting

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Ingress / Egress FilteringAll incoming and outgoing packets are managed by pf (packet filter)

Anonym.OS blocks all inbound and outbound traffic by default, with the exception of the following outbound:

‘Anonymized’ and encrypted

TCP: 80, 443, 9001, 9030, 9090, 9091

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Included Major AppsGraphical:

Xorg 6.8.2

Fluxbox 0.9.13

Firefox 1.0.6

Thunderbird 1.0.7

Gaim 1.5.0

Command Line:

Links .99

Mutt 1.4.2i

GPG 1.4.1

SSH 4.2

Vim 6.3.85

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Onion RoutingAccomplished using Tor 0.1.0.14

ClientOnionProxy

EntryPoint

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

OnionRouter

ExitPoint

OnionRouter

OnionRouter

OnionRouter

OnionRouter

Target

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Local ProxyPrivoxy 3.03 - local web browsing proxy

Works to connect between SOCKS (Tor) and non-SOCKS (http clients)

Configured to block:

User agent*

Referrers

Client operating system and host variables

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Encrypted ProtocolsMost clients natively support encrypted protocls and SOCKS proxies, thus HTTPS, IMAPS, POPS, SSMTP

dsocks pushes non-SOCKS aware applications over SOCKS proxies (example: FTP over Tor)

Anonym.OS thus automagically “socksifies” all non-SOCKS aware clients and protocols, including DNS

What’s Next?

k a o s . t h e o r y s e c u r i t y r e s e a r c h

IssuesTor can be, umm, slow

OpenBSD is not optimized for live CD usage

Distribution is not small

k a o s . t h e o r y s e c u r i t y r e s e a r c h

RoadmapOptimizing performance:

Speed

Compressed file system

Run Tor (alpha) inside a chroot

Boot from / save settings to a USB stick

Install to local HD

Mounting local file systems automatically (NTFS, EXT2 hard drives)

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Roadmap (cont.)Packaged emulator version (QEMU)

More boot-time automation (i.e. brain-dead mode)

Automatic evasion of egress filtering (Tunneling over DNS, ICMP)

Anti-phishing mechanisms

k a o s . t h e o r y s e c u r i t y r e s e a r c h

What you can do!Run a Tor server!

Contribute to Tor and the EFF!(we wouldn’t refuse donations either)

Use encrypted protocols!(Our tor servers have exit policies that only allow: 22, 443, 993, 995, 465)

Internationalization / translation help

Tell us what you want to see!

Worst. Idea. Ever.(Live Demo)

k a o s . t h e o r y s e c u r i t y r e s e a r c h

Blame:fade

~elmore~

arcon

dr. kaos

digunix

beth

atlas

Questions?

If you liked this... you’ll love what’s comin’ next